2024 CVEs (page 289)
Page 289 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28277 | Medium | 6.1 | 2024-05-14 | In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject_name= parameter, enabling Stored Cross-Site Scripting (XSS) attac… |
CVE-2024-28276 | Medium | 6.1 | 2024-05-14 | Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task_name=. |
CVE-2024-28075 | Critical | 9.0 | 2024-05-14 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWind… |
CVE-2024-27852 | Medium | 6.5 | 2024-05-14 | A privacy issue was addressed with improved client ID handling for alternative app marketplaces. This issue is fixed in iOS 17.5 and iPadOS 17.5. A maliciously… |
CVE-2024-27847 | Medium | 5.5 | 2024-05-14 | This issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sono… |
CVE-2024-27843 | High | 7.8 | 2024-05-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to… |
CVE-2024-27842 | High | 7.8 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges. |
CVE-2024-27841 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An app may be able to disclose kerne… |
CVE-2024-27839 | Low | 3.3 | 2024-05-14 | A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicious application may… |
CVE-2024-27837 | Low | 3.3 | 2024-05-14 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keycha… |
CVE-2024-27835 | Low | 2.4 | 2024-05-14 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device… |
CVE-2024-27834 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tv… |
CVE-2024-27829 | High | 7.8 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may lead to unexpected app termination or ar… |
CVE-2024-27827 | Medium | 5.5 | 2024-05-14 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to read arbitrar… |
CVE-2024-27825 | High | 7.1 | 2024-05-14 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. An app… |
CVE-2024-27824 | High | 7.8 | 2024-05-14 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be… |
CVE-2024-27822 | High | 7.8 | 2024-05-14 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to gain root privileges. |
CVE-2024-27821 | Medium | 4.7 | 2024-05-14 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A shortcut may… |
CVE-2024-27818 | High | 7.8 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An att… |
CVE-2024-27816 | Medium | 5.5 | 2024-05-14 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker may… |
CVE-2024-27813 | High | 8.6 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code out of its sandbox or with… |
CVE-2024-27810 | Medium | 5.5 | 2024-05-14 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS… |
CVE-2024-27804 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, watchOS 10… |
CVE-2024-27803 | Low | 2.4 | 2024-05-14 | A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to sh… |
CVE-2024-27798 | High | 7.8 | 2024-05-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An… |
CVE-2024-27796 | High | 7.8 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonom… |
CVE-2024-27793 | High | 7.8 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected app termination or ar… |
CVE-2024-27790 | High | 7.5 | 2024-05-14 | Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue ha… |
CVE-2024-27789 | Medium | 5.5 | 2024-05-14 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Sonoma 14.4, macOS Ventura… |
CVE-2024-27460 | Medium | 6.7 | 2024-05-14 | A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. |
CVE-2024-27401 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents En… |
CVE-2024-27400 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 This reverts drm/amdgpu… |
CVE-2024-27399 | Medium | 5.5 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition betw… |
CVE-2024-27398 | High | 8.0 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is… |
CVE-2024-27397 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a timestamp fiel… |
CVE-2024-27396 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_… |
CVE-2024-27395 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in t… |
CVE-2024-27394 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hli… |
CVE-2024-27393 | High | 7.5 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is intr… |
CVE-2024-27282 | Medium | 6.6 | 2024-05-14 | An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap d… |
CVE-2024-27281 | Medium | 4.5 | 2024-05-14 | An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a… |
CVE-2024-27280 | Critical | 9.8 | 2024-05-14 | A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods… |
CVE-2024-27269 | Medium | 6.8 | 2024-05-14 | IBM QRadar SIEM 7.5 could allow a privileged user to configure user management that would disclose unintended sensitive information across tenants. IBM X-Forc… |
CVE-2024-27082 | High | 7.6 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a typ… |
CVE-2024-26517 | Critical | 9.1 | 2024-05-14 | SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the delete-task.php… |
CVE-2024-26306 | Medium | 5.9 | 2024-05-14 | iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This si… |
CVE-2024-25662 | Medium | 6.1 | 2024-05-14 | Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs. |
CVE-2024-25641 | Critical | 9.1 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through th… |
CVE-2024-25581 | High | 7.5 | 2024-05-14 | When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigg… |
CVE-2024-24157 | Medium | 6.1 | 2024-05-14 | Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via board.py. |
CVE-2024-23576 | High | 7.1 | 2024-05-14 | Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized admini… |
CVE-2024-23473 | High | 8.6 | 2024-05-14 | The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows… |
CVE-2024-23236 | Medium | 5.5 | 2024-05-14 | A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to read arbitrary files. |
CVE-2024-23229 | Medium | 5.5 | 2024-05-14 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.4, macOS Ventura 13.6… |
CVE-2024-22910 | Medium | 6.1 | 2024-05-14 | Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload. |
CVE-2024-22774 | High | 7.8 | 2024-05-14 | An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exe component. |
CVE-2024-22345 | Medium | 6.2 | 2024-05-14 | IBM TXSeries for Multiplatforms 8.2 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized intercep… |
CVE-2024-22344 | Medium | 6.1 | 2024-05-14 | IBM TXSeries for Multiplatforms 8.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed i… |
CVE-2024-22343 | Medium | 4.0 | 2024-05-14 | IBM TXSeries for Multiplatforms 8.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 280190. |
CVE-2024-22064 | High | 8.3 | 2024-05-14 | ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys durin… |
CVE-2024-1693 | Medium | 4.3 | 2024-05-14 | The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_cat… |
CVE-2024-1467 | Medium | 4.3 | 2024-05-14 | The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to… |
CVE-2024-1230 | Medium | 4.3 | 2024-05-14 | The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorre… |
CVE-2024-1229 | Medium | 5.3 | 2024-05-14 | The SimpleShop plugin for WordPress is vulnerable to unauthorized disconnection from SimpleShop due to a missing capability check on the maybe_disconnect_simpl… |
CVE-2024-1166 | Medium | 6.4 | 2024-05-14 | The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all… |
CVE-2024-0445 | Medium | 6.4 | 2024-05-14 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in all versions up to… |
CVE-2024-0100 | Medium | 6.5 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulne… |
CVE-2024-0098 | Medium | 5.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information is… |
CVE-2024-0097 | High | 7.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in ChatRTX UI, where a user can cause an improper privilege management issue by exploiting interprocess com… |
CVE-2024-0096 | High | 7.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in Chat RTX UI, where a user can cause an improper privilege management issue by sending user inputs to cha… |
CVE-2024-0088 | Medium | 5.5 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an improper memory access issue by a network AP… |
CVE-2024-0087 | Critical | 9.0 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file. If this file exists, logs are… |
CVE-2024-34257 | Critical | 9.8 | 2024-05-08 | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowin… |
CVE-2024-34244 | High | 7.5 | 2024-05-08 | libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially craf… |
CVE-2024-33382 | Medium | 5.3 | 2024-05-08 | An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration |
CVE-2024-25533 | Critical | 9.4 | 2024-05-08 | Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can a… |
CVE-2024-25532 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx. |
CVE-2024-25528 | Medium | 5.9 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. |
CVE-2024-31961 | Critical | 9.8 | 2024-05-08 | A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parame… |
CVE-2024-28971 | Low | 3.5 | 2024-05-08 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker c… |
CVE-2024-25531 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx. |
CVE-2024-25530 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx. |
CVE-2024-25529 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx. |
CVE-2024-25527 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. |
CVE-2024-24908 | Medium | 6.5 | 2024-05-08 | Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability. A remote attacker with high privileges c… |
CVE-2024-24788 | Medium | 5.9 | 2024-05-08 | A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. |
CVE-2024-24787 | Medium | 6.4 | 2024-05-08 | On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library fl… |
CVE-2024-22460 | Low | 2.2 | 2024-05-08 | Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability. A remote attacker with high privileges could potentiall… |
CVE-2024-4654 | Medium | 6.3 | 2024-05-08 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /x… |
CVE-2024-4653 | Medium | 6.3 | 2024-05-08 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-3951 | High | 7.1 | 2024-05-08 | PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code. |
CVE-2024-34347 | High | 8.3 | 2024-05-08 | @hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox th… |
CVE-2024-33612 | Medium | 6.8 | 2024-05-08 | An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. N… |
CVE-2024-33608 | High | 7.5 | 2024-05-08 | When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions w… |
CVE-2024-33604 | Medium | 6.1 | 2024-05-08 | A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript i… |
CVE-2024-32980 | Critical | 9.1 | 2024-05-08 | Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applicati… |
CVE-2024-32761 | Medium | 6.5 | 2024-05-08 | Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This le… |
CVE-2024-32113 | Critical | 9.8 | 2024-05-08 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. … |
CVE-2024-32049 | High | 7.4 | 2024-05-08 | BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software version… |
CVE-2024-31156 | High | 8.0 | 2024-05-08 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript… |